Safe Literals

This version of Brakeman introduces a new way of handling “known safe” values (integers, string literals, etc.) where the exact value is unknown. The uses of the values will be replaced with :BRAKEMAN_SAFE_LITERAL instead of actual values, as Brakeman had done previously. The new approach avoids some unhelpful side-effects and allows for more of this kind of thing in the future.

These changes fix up a number of false positives.

Array Safe Literals

In situations like

["hello", "there"].each do |s|
something_with(s)
end

Brakeman will replace s inside the block with :BRAKEMAN_SAFE_LITERAL, since the value must be a string (or nil, but Brakeman doesn’t worrry about that).

Array#map and Array#each are currently supported.

Hash Access with Unknown Key

In code like

some_hash = { x: 1, y: 2}
result = some_hash[some_var]

Brakeman will replace result with :BRAKEMAN_SAFE_LITERAL since the value must be an integer.

Symbolized Keys in Params

Conditionals in Shell Commands

Use of interpolated if expressions (or the ternary version) in shell commands is now handled better, thanks to Jacob Evelyn. The values of the branches will be checked for dangerous values before warning.